Uh oh!
There was an error while loading. Please reload this page.
feat!: remove the Jetify Nix cache - #2940
Merged
Merged
Conversation
The Jetify Nix cache required a Jetify Cloud account: cache URIs and the S3 credentials backing them were fetched from the Jetify API using the logged-in session. Remove it as the first step of making Devbox account-free. Removed: - the `devbox cache` command tree (upload/copy, configure, credentials, enable, info) - internal/devbox/providers/nixcache, which fetched AWS credentials and cache URIs from the Jetify API - the substituter path in installNixPackagesToStore, so nix build no longer receives --extra-substituters or AWS credentials, and the build-from-source retry that existed only to recover from a failed cache build - the S3 narinfo probe in internal/devpkg; cache lookups now only query the public https://cache.nixos.org - internal/setup, the sudo-task framework whose only task was the nix cache host setup, and nix.IncludeDevboxConfig/restartDaemon, which added the user to nix trusted-users and wrote ~root/.aws/config - the nightly cache-upload workflow nix.CurrentConfig/Config.IsUserTrusted are kept: they are generic nix.conf helpers with their own tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the login-gated Jetify Nix cache feature set as the first step toward making Devbox account-free, by deleting the cache command surface area and all code paths that fetched/used Jetify-provided caches and credentials during builds.
Changes:
- Removes the
devbox cacheCLI command tree and associated Devbox/Nix cache upload/copy logic. - Removes Jetify Nix cache integration during installs (no extra substituters, no AWS credential injection, no cache-specific retry path).
- Simplifies narinfo cache probing to query only the public
https://cache.nixos.organd deletes the cache-upload GitHub Actions workflow.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| internal/telemetry/telemetry.go | Removes the cache/substituter-failure telemetry event constant. |
| internal/setup/setup.go | Deletes the sudo-task framework previously used for nix cache host setup. |
| internal/setup/setup_test.go | Deletes tests for the removed setup task framework. |
| internal/nix/nix.go | Removes nix daemon restart helper previously used by cache setup. |
| internal/nix/config.go | Removes nix.conf include writer previously used to trust users for cache access. |
| internal/nix/cache.go | Deletes helper for nix copy --to … used by cache upload/copy. |
| internal/nix/build.go | Removes support for passing extra substituters via BuildArgs. |
| internal/goutil/sync.go | Deletes context-aware sync.Once helpers used by nixcache integration. |
| internal/devpkg/narinfo_cache.go | Removes probing of Jetify caches/S3 narinfo; probes only the public binary cache. |
| internal/devbox/providers/nixcache/setup.go | Deletes nixcache configuration/setup implementation (trusted-users + root AWS config). |
| internal/devbox/providers/nixcache/nixcache.go | Deletes Jetify API integration for cache list + AWS credentials. |
| internal/devbox/packages.go | Removes install-time cache configuration, extra substituters, and retry-from-source fallback. |
| internal/devbox/cache.go | Deletes project/installable upload-to-cache functionality. |
| internal/boxcli/root.go | Removes registration of the cache command from the CLI root. |
| internal/boxcli/cache.go | Deletes the devbox cache command tree implementation. |
| .github/workflows/cache-upload.yml | Removes the nightly/manual cache upload workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Aug 4, 2026
Uh oh!
There was an error while loading. Please reload this page.
mikeland73 added a commit
that referenced
this pull request
Aug 5, 2026
Second of five stacked PRs making Devbox account-free. **Based on #2940** — review that one first; this PR's diff is only the second commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) ⬅ **you are here** - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox secrets` and `env_from: jetify-cloud` stored secrets in Jetify Cloud, which required an org-scoped login plus a `.jetify/project.json` linking the project to a Jetify org. ## What's removed - The `devbox secrets` command tree (alias `envsec`): `init`, `set`, `remove`/`rm`, `list`/`ls`, `download`, `upload`. - `Devbox.Secrets`/`UninitializedSecrets`, the envsec bindings in `internal/devbox/secrets.go`. ## Behavior change worth a look Projects that still set `env_from` to `jetify-cloud` (or the legacy `envsec` / `jetpack-cloud` spellings) **keep working**. `configEnvs` now warns and skips those secrets rather than failing, so an existing `devbox.json` does not have to be edited before the shell will start: ``` Warning: Ignoring env_from = "jetify-cloud". Jetify Cloud secrets are no longer supported by Devbox. ``` An `env_from` value that is neither a `.env` file nor a legacy cloud value is still an error. Both paths are covered by a new testscript, `testscripts/run/envfrom_jetify_cloud.test.txt`. `ConfigFile.IsEnvsecEnabled` is renamed to `IsJetifyCloudEnvFrom`, since detecting the value is now all it does. ## Why `devbox auth whoami` goes here `whoami` is removed in this PR rather than in the auth PR (#2943): its implementation *was* envsec's `WhoAmI`, so there is nothing left to call once the envsec bindings are gone. Deferring it would have meant writing a throwaway reimplementation. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73 added a commit
that referenced
this pull request
Aug 5, 2026
Third of five stacked PRs making Devbox account-free. **Based on #2941** — this PR's diff is only the third commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) ⬅ **you are here** - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why `devbox global push` and `devbox global pull` with no argument synced the global profile to a Jetify-hosted S3 bucket, authenticating by exchanging the logged-in ID token for AWS credentials via `sts:AssumeRoleWithWebIdentity`. ## What changes Both commands now require an argument and keep working for every source that needs no account: git repos, http(s) archives, plain `devbox.json` URLs, and local file paths. - `push` takes a git repo, `pull` takes a git repo / URL / file. - Cobra rejects the no-argument form (`accepts 1 arg(s), received 0`) instead of falling through to the cloud, so the failure is immediate and legible. - `internal/pullbox/s3` is deleted, along with `devopt.Credentials`, which existed only to carry the ID token into it. `push`'s help text previously read "Leave empty to use jetify cloud. Can be a git repo for self storage." — now just "Push a [global] config to a git repo". ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. Manually checked against a build of `main` that the file-path and URL pull paths behave identically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73 added a commit
that referenced
this pull request
Aug 5, 2026
Fourth of five stacked PRs making Devbox account-free. **Based on #2942** — this PR's diff is only the fourth commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) ⬅ **you are here** - **5.** [#2944 — drop dependencies left over from the account features](#2944) ## Why With the nix cache (#2940), cloud secrets (#2941), and cloud global push/pull (#2942) gone, nothing is left that needs a Jetify account — so the login itself goes. This is the load-bearing PR: after the first three, `internal/devbox/providers/identity` has no callers left except telemetry. ## What's removed - `devbox auth login` / `logout` / `tokens new`, and the `AUTH` feature flag that gated them. (`whoami` went in #2941, where its envsec implementation lived.) - `internal/devbox/providers/identity`, which ran the browser OAuth/PKCE flow, stored sessions under `$XDG_CACHE_HOME/jetify/auth`, and exchanged `DEVBOX_API_TOKEN` for an access token. - The identity lookups in telemetry. `user_id` now comes only from the `GITHUB_USER_NAME` hash and the `org_id` property is dropped, so telemetry no longer reads any token from disk. Telemetry is otherwise untouched — `deviceID`, Sentry, and `DO_NOT_TRACK` all behave as before. - The Jetify endpoints in `internal/build`: `Issuer`, `ClientID`, `JetpackAPIHost`, `SuccessRedirect`, `Audience`, `DashboardHostname`. ## Result Devbox no longer contacts `api.jetpack.io` or `accounts.jetify.com`, and no longer reads or writes an auth token anywhere. Verified by running the suite with a real, valid token still sitting in `~/Library/Caches/jetify/auth/` — nothing touches it. `devbox all` (which lists hidden commands too) shows no `auth`, `cache`, or `secrets`. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikeland73 added a commit
that referenced
this pull request
Aug 5, 2026
Last of five stacked PRs making Devbox account-free. **Based on #2943** — this PR's diff is only the fifth commit. ## The stack Each PR is based on the one above it — review and merge bottom-up, starting at #2940. - `main` - **1.** [#2940 — remove the Jetify Nix cache](#2940) - **2.** [#2941 — remove Jetify Cloud secrets](#2941) - **3.** [#2942 — remove global push/pull to Jetify Cloud](#2942) - **4.** [#2943 — remove devbox auth and the identity provider](#2943) - **5.** [#2944 — drop dependencies left over from the account features](#2944) ⬅ **you are here** ## What changes Ran the repo's `devbox run tidy` after the four removal PRs. Dropped as direct dependencies: the AWS SDK v2 modules (`config`, `credentials`, `sts`, `s3`, `feature/s3/manager`), `envsec`, `typeid`, `go-jose`, `oauth2`, `heredoc`, and `tablewriter`. `connectrpc`, `go-oidc`, and `pkg/browser` go with them transitively. `go.jetify.com/pkg` stays — `filecache` and `runx` still use it. `oauth2` is now indirect, reached through runx's GitHub client. ## The `vendor-hash` bit — worth a look `vendor-hash` is regenerated alongside `go.mod`. `flake.nix` reads it as the `buildGoModule` `vendorHash`, so a stale hash makes Nix reuse the previous vendor tree, and **every `devbox run` that needs the glibc-patch flake fails to build devbox itself**: ``` > go.jetify.com/envsec@v0.0.16-...: is marked as explicit in vendor/modules.txt, > but not explicitly required in go.mod ``` `go mod tidy` alone is not enough here, and the breakage is invisible to `go build` and the unit tests — it only surfaces in the testscripts (`plugin/plugin.test.txt` catches it). The `tidy` script in `devbox.json` pairs the two steps for exactly this reason; noting it here since it cost me a debugging cycle. ## Docs No doc changes: `README.md`, `devbox.md`, `CONTRIBUTING.md`, the agent skill, and the VS Code extension README never documented the removed commands. The published CLI reference is generated from Cobra by `devbox gen-docs`, so it picks up the removals automatically. ## Verification `go build`, `go vet`, `go test ./...` (including the full testscript suite), and `golangci-lint run` all pass on this branch on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of five stacked PRs making Devbox account-free. Each PR removes one login-gated feature; the last one drops the dependencies.
The stack
Each PR is based on the one above it — review and merge bottom-up, starting here.
mainWhy
The Jetify Nix cache required a Jetify Cloud account: cache URIs and the S3 credentials backing them were fetched from the Jetify API using the logged-in session. Without an account it did nothing; with one it changed
nix buildbehavior silently on everyadd/install/shell.What's removed
devbox cachecommand tree:upload/copy,configure,credentials,enable,info.internal/devbox/providers/nixcache, which fetched AWS credentials and cache URIs from the Jetify API.installNixPackagesToStore, sonix buildno longer receives--extra-substitutersor AWS credentials — along with the build-from-source retry that existed only to recover from a failed cache build.internal/devpkg. Cache lookups now query only the publichttps://cache.nixos.org.internal/setup, the sudo-task framework whose only task was the nix cache host setup, plusnix.IncludeDevboxConfig/restartDaemon, which added the user to nixtrusted-usersand wrote~root/.aws/configwith acredential_processpointing back atdevbox cache credentials.cache-uploadworkflow.Kept
nix.CurrentConfig/Config.IsUserTrustedstay — they are generic nix.conf helpers with their own tests, not cache-specific.Verification
go build,go vet,go test ./...(including the full testscript suite), andgolangci-lint runall pass on this branch on its own.🤖 Generated with Claude Code